Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Justin_Grant
Justin_Grant
Contributor
Member since:
12-10-2009
06-05-2020
Community Statistics
| Posts | 112 |
| Solutions | 9 |
| Karma Given | 583 |
| Karma Received | 193 |
| Member Since | 12-10-2009 |
Activity Feed
- Got Karma for Best practices for installing and configuring apps in a distributed Splunk install?. 10-26-2023 10:20 AM
- Got Karma for Feature Request: troubleshooting/debugging for field extraction config files. 10-26-2020 08:28 AM
- Karma How do I use the SingleValue module to color code search results? for tpaulsen. 06-05-2020 12:45 AM
- Karma Re: How do I use the singleValue module to color code search results? for Johnvey. 06-05-2020 12:45 AM
- Karma How do i set the default App in splunk? for Erik_Swan. 06-05-2020 12:45 AM
- Karma Re: What does (?m) mean at the beginning of a regex for Johnvey. 06-05-2020 12:45 AM
- Karma Can I add python modules to the Splunk environment? for Simeon. 06-05-2020 12:45 AM
- Karma Re: Can I add python modules to the Splunk environment? for Johnvey. 06-05-2020 12:45 AM
- Karma Re: Can I add python modules to the Splunk environment? for amrit. 06-05-2020 12:45 AM
- Karma Re: Can I inject events into Splunk via a script? for Johnvey. 06-05-2020 12:45 AM
- Karma Re: Can I inject events into Splunk via a script? for ampledata. 06-05-2020 12:45 AM
- Karma how to tell if I have multiline events? for V_at_Splunk. 06-05-2020 12:45 AM
- Karma Re: how to tell if I have multiline events? for V_at_Splunk. 06-05-2020 12:45 AM
- Karma Re: how to tell if I have multiline events? for Stephen_Sorkin. 06-05-2020 12:45 AM
- Karma are search language *keywords* case-sensitive? for V_at_Splunk. 06-05-2020 12:45 AM
- Karma Finalize action for searchscript? for jrodman. 06-05-2020 12:45 AM
- Karma Re: Finalize action for searchscript? for gkanapathy. 06-05-2020 12:45 AM
- Karma I can't see data I know is indexed for cfrln. 06-05-2020 12:45 AM
- Karma Re: I can't see data I know is indexed for cfrln. 06-05-2020 12:45 AM
- Karma How do I allow users to edit a view? for matt. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 2 | |||
| 3 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 13 |
07-11-2010
05:32 PM
11 Karma
This is a question for Splunk users who have installed apps from Splunkbase into a distributed Splunk environment, meaning you have separate forwarders to collect data and search heads/indexers for indexing and searching.
What are the best practices you've figured out for how to download, install, configure, and distribute Splunk apps across your distributed install?
Do you use the Splunk GUI (the "install free" button in Launcher and Manager, as well as the setup pages which come up when you run some apps for the first time) to install and configure apps onto a test server (not a forwarder), and then once your app is configured the way you want it, manually deploy the config out to your forwarders?
Or do you generally download the package from Splunkbase, unpack it yourself, and manually configure it without using the GUI?
And how do you handle the requirement that app configs must be different across different server types in a distributed environment (e.g. apps on search heads shouldn't have inputs enabled)?
Also, how do you handle updating your customized configs once new versions of an app come out?
Finally, any other advice or suggestions for using Splunk Apps in a distributed environment?
Full disclosure: I'm asking these questions because we're trying to figure out to make Splunk easier to deploy apps in a distributed environment. So I'm less asking for my own benefit and more so I can understand how folks are solving these problems today so we can make it easier for you.
... View more
07-08-2010
07:17 PM
3 Karma
I dug through the Splunk Web and Splunk Manager code, and here's what I found:
Apparently build and version are totally unrelated to each other, but (arrrgh!) both must be incremented every time you rev your app. Here's more details:
"version" is displayed to the user in Manager, and on Splunkbase. Upcoming changes to Splunkbase will require that the version specfied in the UI when uploading into Splunkbase match the version specified in app.conf. Furthermore, when uploading a new Splunkbase version, the version string must be different from previous versions. These requirements together mean that you need to rev version in app.conf every time you upload a new version to Splunkbase. But, as far as I can tell, version isn't used anywhere else inside the Splunk product-- it's purely for display purposes inside the product.
"build", however, is used inside the product when generating URLs for static resources (images, CSS, etc.) Since your app's static resources are cached, updating the build number ensures that your new app's static files are reloaded at least once by the browser before being cached (until the next increment of the build setting).
So you'll definitely want to increment the build number every time you rev any of your app's static files.
And you'll want to increment version every time you upload a new version of your app to Splunkbase.
The safest thing would be to get in the habit of incrementing both every time you rev your app.
... View more
07-08-2010
06:29 PM
In the "apps" page in Manager (http://localhost:8000/en-US/manager/search/apps/local), there's a Sharing column which always starts with "App |" and is followed by a permissions link.
Is there a way to change this sharing? What would it mean to have non-app sharing for an app? If it makes no sense, why is "App" listed there at all?
... View more
06-30-2010
10:32 PM
Yes. You can index any kind of IT data in splunk, including simple metrics data like JMX. It's also easy to correlate metrics to text data (e.g. log messages) so you can figure out what else was happening on your server when you got a particular error message or saw a worrisome JMX value.
In order to get WebLogic JMX into Splunk, you'll want to write a scripted input (e.g. a java command-line app, Jython script, etc.) which collects the JMX metrics you want and then prints the data to stdout as name/value-pair text, which Splunk will then index.
You can take a look at how we did this in the Splunk for WebSphere Application Server app, where we wrote a Jython script which we executed inside WebSphere's command-line shell to call JMX to fetch metrics and print them to stdout. Splunk then indexes the data and automatically extracts fields. Look for WebSphereMBeanStats.py (inside the Splunk for WAS app) to see our Jython script.
... View more
06-29-2010
09:43 PM
I'd like to create a shortcut for admins to create specific new data inputs. For example, if I want to have a shortcut which autmatically sets the Host regex for file inputs.
Is this possible? Obviously, the easiest way would be to use a URL (e.g. pointing to /manager/search/data/inputs/monitor/_new?action=edit ) with query string parameters added which populate manager input page controls.
Or, a POST using client script which achieved the same thing would be fine too-- as long as the user can fill in the remaining fields manually.
Is this possible?
... View more
06-29-2010
10:12 AM
3 Karma
Our app's setup.xml page uses a custom EAI endpoint. I know when we throw an exception from the handleEdit method, the setup page will refuse to save and the exception's message will be displayed in red text at the top of the screen.
But what if we only want to display a "warning" message to users, but without preventing the user from saving settings? Is there a way, in our EAI endpoint, to display a message at the top of the screen without throwing an exception and preventing saving?
Ideally, our message would show up with a yellow background, but the blue-background regular message is OK too.
... View more
06-27-2010
10:51 PM
FWIW, it seems like one of these settings is unnecessary. Build numbers are typically included along with version strings in most products.
... View more
06-24-2010
10:47 PM
6 Karma
I’m seeing conflicting info in the Splunk docs about how an app should specify its version in app.conf.
I’ve seen 2 references:
in http://www.splunk.com/base/Documentation/Latest/Admin/Appconf to a version property (in the [launcher] stanza)
in http://www.splunk.com/base/Documentation/latest/Developer/Step3AddConfigurations to a build property (in the [install] stanza).
How does the product use each of these? When an app is updated, should we update both of these?
... View more
06-24-2010
03:32 AM
looking at the other answers, it looks like (so far at least) no one has figured out how to do this.
... View more
06-04-2010
01:11 AM
On a 4.1.2 Windows forwarder, we have a .path scripted input pointing to IBM WebSphere's wsadmin command-line shell. The wsadmin process launches another process (java.exe running a jython script that we passed into wsadmin ). That java process ("grandchild" from Splunk's perspective) runs a custom Jython script we wrote, pipes the output of that script back to wsadmin ("child" from Splunk's perspective) which in turn outputs that text back to Splunk. So far so good.
Here's the problem: when we stop Splunk, the "child" process is correctly killed by Splunk, but the "grandchild" process lives on. I assume wsadmin is not launching the java process in a way which allows Splunk to kill the whole process tree. (Unfortunately, we can't change how wsadmin launches processes, since it's IBM's code.)
Making matters worse, the orphan java process hanging around prevents restarting Splunk! We get this error when trying to restart Splunk:
ERROR: The mgmt port [8089] is already bound. Splunk needs to use this port. Would you like to change ports? [y/n]:
If we manually kill the orphan java.exe process, the error above doesn't happen. We can hack around the issue by having the grandchild process commit suicide when splunkd exits. But that requires a separate thread and/or frequent calls to watch for splunk exiting-- and allows a race condition where Splunk fails to restart before the grandchild detects that splunkd is gone.
Any idea why I'm getting the error above, given that the process Splunk was previously talking to has been killed?
... View more
05-29-2010
05:47 PM
What version of Python is used to run Splunk 4.1.x. scripted inputs?
Which Python libraries are available for use in scripted inputs-- and which libraries (of those which I might normally expect to be available) are not available?
Which libraries (if any) have been modified by Splunk and so have different behavior than I'd expect from a regular Python distro?
... View more
05-25-2010
04:55 PM
3 Karma
Per this thread, it sounds like you can transform a .cap file to text using a command like this:
tshark -r {file} -V
You could set up a Splunk scripted input using the command line above for one-time import of a single cap file.
This doesn't help you for up-to-the-second packet capture, but with some scripting fu you could probably cut new tshark CAP files every so often (e.g. every hour) and then use the scripted approach above to transform each new file into the text that Splunk needs.
... View more
05-25-2010
04:47 PM
2 Karma
Can Splunk show (and if so, how?) different scales for each line in a line graph while auto-computing the correct scale for each (meaning the lines will auto-size their height based on the max value for each metric)?
more details: in a security-related view, I'd like to chart attempted logins/day and failed logins/day on the same line graph. But attempted logins will (hopefully!) outnumber failed logins by 100x or more. So I'd like to use different scales for each metric.
... View more
05-25-2010
04:33 PM
2 Karma
I have two multiline events (they are stuffed with the contents of two versions of a config file) and I'd like a good way to show a view which allows users to examine where the events are different (besides time and/or host, which will of course be different).
Is this kind of view easy to build with Splunk, and if so how would I build it?
Ideally this would be a side-by-side differences view like you can see in TortoiseMerge, WinDiff, or a similar tool. But I'd be happy with something lower-end too (e.g. just a text output listing the differences without any side-by-side UI).
... View more
05-14-2010
01:41 AM
5 Karma
Yes! Check out Splunk for WebSphere Application Server (WAS) here: http://www.splunkbase.com/apps/Splunk+for+WebSphere+Application+Server
This app will index your IBM WAS logs, JVM metrics, and server configuration files in Splunk, and it provides sample dashboards and searches for troubleshooting and performance monitoring. The app handles field extractions, line breaking, and other config details which aren't that hard to do by hand, but having these packed into an app will save you some time so you can start searching right away. It's an easy way to get Splunk up and running with your J2EE app server data.
This App also works with IBM applications based on WebSphere, such as WebSphere Portal or WebSphere Commerce (although Splunk may need a little extra configuration to capture data unique to those apps which don’t go in the shared WebSphere logs, metrics, or configs).
If you have a question or bug report about this app , don't leave comments here on this question. Instead, please ask a new question and stick the app-websphereas-splunk tag on your question. Here's a one-click-link to the Splunk Answers new-question page with that tag already applied.
Thanks!
... View more
05-14-2010
01:35 AM
2 Karma
Can Splunk monitor IBM WebSphere Application Server? (WAS)
... View more
05-13-2010
05:13 AM
3 Karma
Windows doesn't have a built-in way to unpack the .tar.gz format used by Splunk apps downloaded from Splunkbase. What are good ways to install Splunk apps on Windows?
I'm ideally looking for multiple options I can use dependning on the scenario:
using the Splunk command-line (CLI)
using a free, downloadable, 3rd-party Windows GUI unzipper (can you recommend a good one for .tar.gz files?)
via the Splunk REST API, so I can automate a solution for an install of an app on a remote Splunk server
any other cool way you can suggest.
Of course, what I really want is a way in the Splunk launcher or Manager that I can upload an app into Splunk, but I assume this isn't there in Splunk 4.1 yet.
... View more
05-12-2010
10:18 PM
OK, thanks! Inside the app config, can we use the word "default" or should we use "main" as index name?
... View more
05-12-2010
05:04 PM
1 Karma
If our app's inputs.conf uses an index other than "main" (e.g. a custom index for our app) does our app's setup UI (or the user via manual changes) need to create the index? Or will Splunk automatically create the index if it doesn't already exist?
... View more
- Tags:
- configuration
- index
05-12-2010
05:00 PM
2 Karma
We're building a Splunk app and need to decide which index to use to store the events captured by our app's inputs. We'll let the use choose the index in our app's Setup configuration page (aka setup.xml), but we need to decide on a default.
Got a suggestion for whether our default should be "main" or should be a custom index for the app? If "it depends" then when would we want to choose one option over the other?
... View more
05-08-2010
03:11 AM
Hi @Lowell - good point. I changed the dash to an underscore in my question.
... View more
05-07-2010
04:45 AM
Yet another case-sensitivity question: are sourcetype names case-sensitive?
... View more
05-07-2010
01:00 AM
2 Karma
We're building an app for WebSphere and trying to come up with a naming convention for field names.
I'm nervous about simple field names (e.g. "ExceptionId") because if users write searches like "ExceptionId=123" and another app gets installed which also defines an "ExceptionId" field, then all those existing searches might break.
So we're thinking about prefixing all our field names with a common prefix, e.g. "websphere_". Is this a good idea or a bad idea?
If "good idea" then should we use lower case or PascalCase, and should we use dashes, colons, or some other character as a separator?
I realize that sometimes users will want to aggregate results for the same field name across multiple apps. I've been thinking that we should handle that case using field aliases so our prefixed fields could be mapped to "bare" field names in a [common information model](http://www.splunk.com/base/Documentation/latest/Knowledge/UnderstandandusetheCommonInformationModel). So, the question above is solely about what we should do when sharing is not intended by the app author, and how to avoid unintended sharing of field names across apps.
... View more
05-07-2010
12:40 AM
1 Karma
We're building an app for WebSphere. We're prefixing all the app's sourcetypes with "WebSphere:" to disambiguate them from other apps' sourcetypes.
Now we need to decide about lowercase or PascalCase for our sourcetype prefix.
Is it preferable to do "websphere:somesourcetype" or "WebSphere:somesourcetype"?
... View more
- Tags:
- app
- sourcetype
05-06-2010
10:28 AM
1 Karma
We definitely have a lot of customers asking for Nagios integration. The things we hear most are:
raising Nagios alerts in response to Splunk alerts.
logging alerts raised by Nagios into Splunk, to correlate problems reported by nagios with root-cause log data available in Splunk.
logging raw data collected by Nagios into Splunk, to enable Splunk to report on historical trends collected by nagios and to correlate monitoring data collected by nagios with log data collected by Splunk.
Does that list sounds like the right set of things to focus on? (you can tack a comment onto this answer with your response)
... View more
